From 70c6c9338930cbf942a871208e952ba32117a2bf Mon Sep 17 00:00:00 2001 From: Federico Di Pierro Date: Mon, 27 Mar 2023 17:17:38 +0200 Subject: [PATCH] chore(userspace): improved wording. Signed-off-by: Federico Di Pierro Co-authored-by: Melissa Kilby --- falco.yaml | 3 ++- userspace/falco/app/actions/helpers_inspector.cpp | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/falco.yaml b/falco.yaml index e60ccb5f..cd857523 100644 --- a/falco.yaml +++ b/falco.yaml @@ -170,7 +170,8 @@ syscall_event_drops: syscall_event_timeouts: max_consecutives: 1000 -# Enabling this option allows Falco to drop failed syscalls exit events. +# Enabling this option allows Falco to drop failed syscalls exit events +# in the kernel driver before the event is pushed onto the ring buffer. # This can enable some small optimization both in CPU usage and ring buffer usage, # possibly leading to lower number of event losses. # Be careful: enabling it also means losing a bit of visibility on the system. diff --git a/userspace/falco/app/actions/helpers_inspector.cpp b/userspace/falco/app/actions/helpers_inspector.cpp index ade62702..bf6c4e92 100644 --- a/userspace/falco/app/actions/helpers_inspector.cpp +++ b/userspace/falco/app/actions/helpers_inspector.cpp @@ -127,7 +127,7 @@ falco::app::run_result falco::app::actions::open_live_inspector( if (s.config->m_syscall_drop_failed) { - falco_logger::log(LOG_DEBUG, "Failed syscalls exit event will be dropped.\n"); + falco_logger::log(LOG_DEBUG, "Failed syscall exit events are dropped in the kernel driver\n"); inspector->set_dropfailed(true); } return run_result::ok();